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DETAILED ACTION 

1. A reply under 37 CFR 1.1 16 was received on 22 June 2005. By that reply, 
Claims 1,12, and 13 were amended. No claims have been added or canceled. A 
Notice of Appeal was received on 15 August 2005. An Appeal Brief was received on 12 
October 2005 and a supplemental Appeal Brief was received on 14 December 2005. 
Claims 1-22 are currently pending in the present application. 

Response to Arguments 

2. In view of the supplemental Appeal Brief filed on 1 4 December 2005, 
PROSECUTION IS HEREBY REOPENED. New grounds of rejection are set forth 
below. 

To avoid abandonment of the application, appellant must exercise one of the 
following two options: 

(1 ) file a reply under 37 CFR 1 .1 1 1 (if this Office action is non-final) or a reply 
under 37 CFR 1.113 (if this Office action is final); or, 

(2) initiate a new appeal by filing a notice of appeal under 37 CFR 41 .31 followed 
by an appeal brief under 37 CFR 41 .37. The previously paid notice of appeal fee and 
appeal brief fee can be applied to the new appeal. If, however, the appeal fees set forth 
in 37 CFR 41.20 have been increased since they were previously paid, then appellant 
must pay the difference between the increased fees and the amount previously paid. 
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A Supervisory Patent Examiner (SPE) has approved of reopening prosecution by 
signing below: 



3. The information disclosure statement received 1 9 January 2006 was received 
during the period set forth in 37 CFR 1 .97(d) (i.e. after the mailing date of a final 
rejection). Applicant has paid the fee as required in 37 CFR 1.97(d)(2) but has not 
provided a statement under 37 CFR 1.97(e) as required by 37 CFR 1.97(d)(1). 
However, because prosecution is herein reopened, the Examiner has considered the 
above information disclosure statement as though it were filed under 37 CFR 1 .97(c). 



4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 



EMMANUEL L.M0ISE 
SUPERVISORY PATENT EXAMINER 
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5. Claims 1-3, 5, 7-12, and 20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Calamera et al, US Patent 6463533, in view of Payne et al, US 
Patent 5715314. 

In reference to Claim 1 , Calamera discloses a system including a link processor 
that identifies and encrypts the address portion of a URL (DOMAIN and PATH of 
column 8, lines 43-48) and incorporates the encrypted address portion with the non- 
encrypted portion into a single processed URL data string and a communication 
processor that incorporates the processed URL data string into formatted data for 
communication to a destination system (ALIAS of column 8, lines 58-60). However, 
although Calamera discloses providing a decryption key to a server system (column 9, 
lines 20-26), Calamera does not explicitly disclose providing the decryption key to the 
destination system. 

Payne discloses a system including a link processor that encrypts various 
portions of a URL and incorporates the encrypted portion with a non-encrypted portion 
into a single processed URL (for example, column 5, lines 30-47) and that further 
provides a decryption key to a destination system (for example, column 5, lines 44-47). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the system of Calamera to include the provision of a 
decryption key to the destination system, in order to increase integrity by allowing the 
recipient to verify that the encrypted URL is correct (see Payne, column 1 , line 64- 
column 2, line 2; see also column 5, lines 57-60 and column 7, lines 33-36). 
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In reference to Claims 2 and 3, Calamera and Payne further disclose adaptively 
identifying the address portion as lying between "http://" and either a question mark or 
pound sign (Calamera, column 8, lines 43-48, where the address portion is only the 
domain and path of the URL and nothing further). 

In reference to Claims 5, 7, and 12, Calamera and Payne further disclose 
compressing the address portion of the URL prior to encryption, where the address 
portion is encoded with MD5 (see Calamera, column 8, lines 48-50, where the hash 
function is MD5; see also Payne, column 5, lines 44-47). 

In reference to Claim 6, Calamera and Payne disclose everything as applied to 
Claim 5 above. However, neither Calamera nor Payne explicitly discloses converting 
the address portion to lower case before compression. Official notice is taken that it is 
well known that addresses within URLs can be case insensitive. Official notice is 
further taken that many hash functions, including the MD5 hash function as recited in 
Claim 12, by definition, are case sensitive, and will return a different result if even one 
input bit is changed, and certainly if a character is changed from lowercase to 
uppercase. Therefore, it would have been obvious to one of ordinary skill in the art at 
the time the invention was made to modify the system of Calamera and Payne by 
including forcing all characters in the input of the hash function, i.e. the address portion, 
to lowercase, in order to insure that a comparison of hash function results will return the 
proper comparison result. 

In reference to Claim 10, Calamera and Payne further disclose concatenating the 
address portion with data associated with a personal record to form a data element and 
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encrypting the data element (Calamera, ID at column 8, lines 56-58; Payne, column 5, 
lines 30-43). 

In reference to Claim 1 1 , Calamera and Payne further disclose that the personal 
record data is a user identifier (Calamera, ID defined at column 7, lines 56-58). 

Claim 20 is directed to a method that corresponds substantially to the system of 
Claim 1, and is rejected by a similar rationale. 

6. Claim 4 is rejected under 35 U.S.C. 103(a) as being unpatentable over Calamera 
in view of Payne as applied to claim 3 above, and further in view of Calow, US Patent 
6714928. 

Calamera and Payne disclose everything as applied to Claim 3 above; however, 
neither Calamera nor Payne explicitly discloses using dynamic page languages such as 
ASP. Calow discloses a system in which Active Server Pages or another dynamic page 
server can be used (column 3, lines 49-59) where parameters for the dynamic pages 
include server names and script names (see columns 29-32, with the table of the ASP 
example). Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to modify the system of Calamera and Payne to include 
usage of ASP and appropriate parameters, in order to allow application software to be 
hosted by a user's browser (see Calow, column 2, lines 34-39). 
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7. Claims 8 and 9 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Calamera and Payne as applied to claim 1 above, and further in view of Levergood, US 
Patent 5708780. 

In reference to Claims 8 and 9, Calamera and Payne disclose everything as 
applied to Claim 1 above. Calamera and Payne further disclose a duration and 
expiration times (Payne, column 5, lines 37-42); however, neither Calamera nor Payne 
explicitly disclose incorporating a session identifier into the processed URL. Levergood 
discloses a system including a link processor (column 5, lines 42-65) and a processor 
incorporating URL data into formatted data for communication to a destination system 
(column 4, lines 1-6 and column 7, lines 15-21), and Levergood further discloses that a 
session identifier is included in a processed URL data string (column 5, lines 52-54, 
noting column 3, lines 12-16, where SID is a session identifier). Therefore, it would 
have been obvious to one of ordinary skill in the art at the time the invention was made 
to modify the system of Calamera to include a session identifier, in order to allow 
authenticated access across multiple servers (see Levergood, column 6, lines 17-26). 

8. Claims 13 and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Calamera in view of Levergood. 

In reference to Claim 13, Calamera discloses a system including a link processor 
that identifies and encrypts the address portion of a URL (DOMAIN and PATH of 
column 8, lines 43-48) and incorporates the encrypted address portion with the non- 
encrypted portion into a single processed URL data string and a communication 
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processor that incorporates the processed URL data string into formatted data for 
communication to a destination system (ALIAS of column 8, lines 58-60). However, 
Calamera does not explicitly disclose the use of a session identifier. 

Levergood discloses a system including a link processor (column 5, lines 42-65) 
and a processor incorporating URL data into formatted data for communication to a 
destination system (column 4, lines 1-6 and column 7, lines 15-21), and Levergood 
further discloses that a session identifier is included in a processed URL data string 
(column 5, lines 52-54, noting column 3, lines 12-16, where SID is a session identifier). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the system of Calamera to include a session identifier, in 
order to allow authenticated access across multiple servers (see Levergood, column 6, 
lines 17-26). 

In reference to Claim 14, Calamera and Levergood disclose everything as 
applied to Claim 1 3 above. Calamera and Levergood further disclose compressing the 
identified portion of the URL before encrypting the identified portion (see Calamera, 
column 8, lines 48-50; see Levergood, column 5, lines 61-65). However, neither 
Calamera nor Levergood explicitly discloses converting the address portion to lower 
case before compression. Official notice is taken that it is well known that addresses 
within URLs can be case insensitive. Official notice is further taken that many hash 
functions, including the MD5 hash function as recited in Claim 12, by definition, are case 
sensitive, and will return a different result if even one input bit is changed, and certainly 
if a character is changed from lowercase to uppercase. Therefore, it would have been 
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obvious to one of ordinary skill in the art at the time the invention was made to modify 
the system of Calamera and Levergood by including forcing all characters in the input of 
the hash function, i.e. the address portion, to lowercase, in order to insure that a 
comparison of hash function results will return the proper comparison result., 

9. Claims 15, 16, 18, 19, 21, and 22 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Payne in view of Calamera. 

In reference to Claim 15, Payne discloses a system including an input processor 
receiving an encoded URL (column 5, lines 53-56), a link processor identifying an 
encrypted portion of the received URL and a corresponding non-encrypted portion of 
the URL and decrypting the encrypted portion thereby generating a decrypted URL 
portion, and a validation processor determining if the decrypted URL portion has been 
subject to unauthorized modification by determining if the decrypted portion is different 
from the non-encrypted portion (see column 5, lines 57-60). However, although Payne 
discloses that the URL includes, inter alia, domain identifiers and buyer network 
address (column 5, lines 30-43), Payne does not explicitly disclose that the URL portion 
is an address. 

Calamera discloses a system including an input processor receiving an encoded 
URL (column 9, lines 20-23), a link processor identifying an encrypted address portion 
of the received URL and a corresponding non-encrypted address portion of the URL 
and decrypting the encrypted portion thereby generating a decrypted URL address 
portion (column 9, lines 24-26), and a validation processor determining if the decrypted 
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URL address portion has been subject to unauthorized modification by determining if 
the decrypted portion is different from the non-encrypted portion (column 9, lines 29-31). 
Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the system of Payne to explicitly include the address 
portions of the URLs, in order to allow tracking of the user across several application 
sites (see Calamera, column 2, lines 57-65). 

In reference to Claim 16, Payne and Calamera further disclose that the decrypted 
portion is a first hash value (Payne, column 5, lines 44-47; Calamera, column 9, lines 
24-26), and additionally disclose applying a hashing function to the non-encrypted 
portion to create a second hash value and comparing the first and second hash values, 
where a match determines a successful validation (Payne, column 5, line 57-column 6, 
line 8; Calamera, column 9, lines 26-36). 

In reference to Claims 18 and 19, Payne and Calamera further disclose a 
personal record, specifically a user identifier, in the URL (Calamera, ID at column 8, 
lines 56-58 and column 7, lines 56-58; Payne, column 5, lines 30-43). 

Claims 21 and 22 are directed to methods that correspond substantially to the 
systems of Claims 15 and 16, and are rejected by a similar rationale. 

10. Claim 17 is rejected under 35 U.S.C. 103(a) as being unpatentable over Payne in 
view of Calamera as applied to claim 15 above, and further in view of Levergood. 

Payne and Calamera disclose everything as applied to Claim 15 above; however, 
neither Payne nor Calamera explicitly disclose a session identifier in the non-encrypted 
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portion of the URL. Levergood discloses a link processor (column 5, lines 42-65) and a 
validation processor determining if a decrypted URL has been subject to unauthorized 
modification (column 6, lines 8-16, where the SID in the URL is validated) in which the 
URL includes a session identifier (column 5, lines 52-54, noting column 3, lines 12-16, 
where SID is a session identifier). Therefore, it would have been obvious to one of 
ordinary skill in the art at the time the invention was made to modify the system of 
Payne and Calamera to include a session identifier in order to authenticated access 
across multiple servers (see Levergood, column 6, lines 17-26). 



Conclusion 



1 1 . The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Binding et al, US Patent 6751 731 , discloses a system in which encrypted 
parameters for establishing security may be appended to a URL request (see 
especially column 12). 

b. Ganesan et al, US Patent 6948063, discloses a system that protects the 
integrity of URLs using encryption and/or hashing. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Zachary A. Davis whose telephone number is (571 ) 272- 
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3870. The examiner can normally be reached on weekdays 8:30-6:00, alternate 
Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 





EMMANUEL L. MOISE 
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